CVE-2026-96454 in Pake
Summary
by MITRE • 09/23/2026
Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content.
The first is in src-tauri/capabilities/default.json, which grants IPC access with "remote": { "urls": ["https://*.*"] }. That wildcard tells Tauri to accept IPC from any HTTPS origin, not just the site the application was built to wrap. The second is "withGlobalTauri": true in src-tauri/tauri.conf.json, which puts window.__TAURI__.core.invoke() in reach of ordinary page JavaScript.
Tauri's access control list only checks plugin commands, the ones prefixed with plugin:. Commands the application registers itself through generate_handler!, known as app commands, are never checked against the ACL. So once an origin holds IPC access, it can call every app command with nothing else standing in the way. Pake registers download_file as an app command, and it does not appear in the permissions list because it does not need to.
The practical effect is that any script running on any HTTPS page inside a Pake application can invoke the application's native commands. That includes third-party script the wrapped site loads on its own, such as analytics, advertising, or a compromised CDN. Anyone distributing their own Pake application gets the same access without asking for it. Chained with the path traversal in download_file that is tracked separately as CVE-2026-82635, this reaches arbitrary file write and persistent code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability described involves a critical misconfiguration within applications generated by Pake, a tool that converts websites into desktop applications using the Tauri framework. This issue stems from two default settings inherited from the upstream template: an overly permissive IPC access control list and the exposure of global Tauri APIs to untrusted web content. The first setting is found in src-tauri/capabilities/default.json, where remote URLs are configured with a wildcard pattern https://.. This configuration instructs Tauri to accept inter-process communication from any HTTPS origin rather than restricting it solely to the specific website being wrapped. Consequently, malicious scripts hosted on third-party domains can establish IPC connections with the application host process. The second setting is withGlobalTauri set to true in src-tauri/tauri.conf.json, which exposes window._TAURI_.core.invoke() to ordinary page JavaScript. This exposure allows any script running within the application's webview context to directly invoke native commands provided by Tauri plugins or registered handlers.
The core technical flaw lies in how Tauri handles access control for different types of commands. The framework’s ACL mechanism only validates permissions for plugin commands, which are typically prefixed with plugin:. However, app commands registered via the generate_handler! macro bypass this validation entirely. Since Pake registers download_file as an app command rather than a plugin command, it is not subject to permission checks in the ACL. This architectural oversight means that once an origin gains IPC access through the wildcard URL configuration, it can invoke any app command without restriction. The combination of unrestricted IPC origins and unvalidated app commands creates a severe security gap where arbitrary native functionality becomes accessible to potentially malicious web content.
The operational impact is significant because third-party scripts commonly embedded in modern websites, such as analytics trackers, advertising networks, or compromised CDN resources, can exploit this vulnerability. If any of these external services are compromised or serve malicious payloads, they can leverage the exposed IPC interface to execute native commands within the desktop application environment. This effectively bypasses standard web sandboxing protections and grants attackers direct access to system-level operations. The risk is further amplified by the fact that every Pake-generated application inherits this insecure default configuration unless explicitly modified by the developer, meaning a wide range of distributed applications are vulnerable out-of-the-box without requiring any additional exploitation steps beyond loading a malicious page within the app’s webview.
This vulnerability can be chained with other flaws to achieve more severe outcomes. Specifically, when combined with path traversal vulnerabilities in functions like download_file, as tracked separately under CVE-2026-82635, attackers can write arbitrary files to the local filesystem. This capability enables persistent code execution by placing malicious executables or scripts into accessible directories that may be automatically loaded upon application restart or user interaction. From a classification perspective, this issue aligns with CWE-749: Exposure of Dangerous Method to Users and CWE-284: Improper Access Control, as it involves granting excessive privileges to untrusted entities due to misconfigured access controls. In terms of the MITRE ATT&CK framework, this vulnerability facilitates lateral movement within the local system context by allowing remote code execution through web-based vectors, potentially leading to privilege escalation if the application runs with elevated permissions or accesses sensitive user data stored locally.
Mitigation strategies should focus on tightening IPC origin restrictions and disabling unnecessary global API exposure. Developers must replace the wildcard https://. pattern in default.json with specific domain allowlists that strictly match only trusted sources. Additionally, setting withGlobalTauri to false prevents direct access to window._TAURI_.core.invoke() from untrusted scripts, forcing all interactions through properly secured channels. It is also recommended to review app commands registered via generate_handler! and ensure they implement internal permission checks if exposed to web content. Regular audits of third-party script dependencies within wrapped websites can further reduce the attack surface by minimizing opportunities for malicious code injection. Updating Pake templates to enforce secure defaults by default will help protect users who rely on pre-configured settings without deep security expertise.